CVE Vulnerability Catalog

The Slider Hero plugin for WordPress up to version 9.1.7 is vulnerable to second-order SQL Injection via the qcld_sliderhero_duplicate() function. Slide data is safely stored, but during slider duplication, values are concatenated without preparation, allowing administrators to inject additional SQL queries and extract sensitive data.

The WCPOS – Point of Sale (POS) plugin for WooCommerce up to version 1.9.14 is vulnerable to Code Injection via the 'thermal' template engine. Authenticated attackers with Shop Manager-level access can inject arbitrary PHP code into a template that is subsequently executed on the server, leading to remote code execution.

The All-in-One WP Migration and Backup WordPress plugin before version 7.108 does not restrict migration import to network administrators on multisite, allowing a subsite admin to execute arbitrary PHP code across the entire network.

The Smash Balloon Social Post Feed – Simple Social Feeds plugin for WordPress up to version 4.9.0 is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute. Authenticated attackers with contributor-level access and above can inject arbitrary scripts that execute when a user accesses the injected page.

The Snippet Shortcodes plugin for WordPress up to version 5.2.0 is vulnerable to Stored Cross-Site Scripting via shortcode attributes. Authenticated attackers with contributor-level access and above can inject arbitrary scripts that execute when a user accesses the injected page.

The Youtube Showcase plugin for WordPress up to version 4.0.4 is vulnerable to Stored Cross-Site Scripting via the 'emd_mb_meta' shortcode. Attachment titles are interpolated into HTML attributes without proper escaping, allowing authenticated attackers with author-level access and above to inject arbitrary scripts.

The Toocheke Companion plugin for WordPress up to version 2.10 is vulnerable to Stored Cross-Site Scripting via the 'series_bg_color' post meta field. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when an administrator views the series list table.

The Manual Image Crop WordPress plugin before version 1.15 lacks capability checks and nonce verification on the authenticated AJAX action for cropping images; any logged-in user can pass. A subscriber can supply an arbitrary attachment ID and overwrite its intermediate-size image (e.g., thumbnail) and mutate its metadata, regardless of ownership. This is a cross-user integrity/defacement issue. The action also has no nonce, making it vulnerable to CSRF.

The WC Vendors plugin for WordPress up to version 2.7.0 is vulnerable to generic SQL Injection via the 'status' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with shop manager-level access and above to append additional SQL queries, potentially extracting sensitive information from the database.

The ShortPixel Adaptive Images plugin for WordPress up to version 3.11.5 is vulnerable to authorization bypass. Improper verification of user permissions allows authenticated attackers with subscriber-level access and above to modify configuration options of third-party plugins such as ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache, as well as the plugin's own API key and account binding.

The StoreEngine plugin for WordPress up to version 2.1.1 is vulnerable to Directory Traversal via the parse_file_path function. This allows authenticated attackers with vendor-level access and above to read the contents of arbitrary files on the server, which may contain sensitive information.

The Divi WordPress theme before version 5.9.0 does not properly escape some Social Media Follow module settings before outputting them in link attributes, allowing users with contributor role or above to store JavaScript that executes when a higher-privileged user, such as an admin, views the post.

The Turnkey bbPress by WeaverTheme plugin for WordPress up to version 1.7.1 is vulnerable to PHP Object Injection via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function. The function reads raw file contents and passes them directly to unserialize() without validation, allowing authenticated attackers with administrator-level access and above to inject a PHP Object.

A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. It affects the gets function in the Customer Search Module, causing a stack-based buffer overflow. The attack can be initiated remotely, and the exploit has been made public.

A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. The issue affects the GroovyShell.evaluate function in the /execute file of the NoticeController component, leading to code injection. The attack can be launched remotely, and the exploit has been released.

The Frontend Admin by DynamiApps plugin for WordPress up to version 3.29.9 contains a privilege escalation vulnerability. It stems from a flawed condition in the `ActionUser::conditions_logic()` function that skips the authorization check when the user ID is a string, allowing an attacker to escalate privileges to administrator.

The ProfilePress plugin for WordPress up to version 4.16.19 is vulnerable to arbitrary shortcode execution. This is due to improper validation before running do_shortcode. Authenticated attackers with subscriber-level access can execute arbitrary shortcodes, and partial mitigations can be bypassed via various render paths.

The Royal Elementor Addons plugin for WordPress up to version 1.7.1064 contains a Server-Side Request Forgery (SSRF) vulnerability in the Form Builder widget. An attacker with Contributor-level access can make requests to arbitrary locations, including internal services.

The Kubio AI Page Builder plugin for WordPress up to version 2.8.5 is vulnerable to authorization bypass. Improper permission verification allows authenticated attackers with contributor-level access to overwrite front-page configuration, rewrite navigation menus, replace template parts, and overwrite global data. The nonce is available to all block editor users, making it ineffective.

The Podlove Podcast Publisher plugin for WordPress up to version 4.5.3 contains an arbitrary file deletion vulnerability. Authenticated attackers with Contributor-level access can delete arbitrary files on the server, potentially leading to remote code execution.